Every secret, every environment, on one screen.

Set a value once in production and let staging and preview inherit it. Override only what differs. Serve it to Kubernetes over HTTP, pull it from the CLI, or push it upstream to Unkey. Self-hosted, AES-256-GCM at rest.

Start free$ npx @steamsets/cubby login

key	production base	staging inherits production	preview inherits staging
DATABASE_URL
STRIPE_SECRET_KEY
REDIS_URLref
SMTP_PASSWORD

set in this environment
inherited — change it once, it lands everywhere
not set

getting it into your app

Read it from the cluster, pull it on your laptop, or push it upstream.

kubernetes · external secrets

apiVersion: external-secrets.io/v1
kind: ExternalSecret
spec:
  dataFrom:
    - find:
        path: backend/production

Inheritance and references resolve server-side, so the pod only ever sees flat values.

cli · local and ci

$cubby run -e production -- pnpm dev

$cubby pull -e staging > .env

$cubby set STRIPE_SECRET_KEY

Values never touch disk with cubby run — they go straight into the child process environment.

sync · push upstream

backend / production

pushes to

unkey · api / prod

Every write re-pushes the whole resolved set, so the destination can't drift out of sync.

Stop grepping four .env files.

Self-host it in a few minutes, or share a single secret right now without making an account.

Start free quick-share — no account